LEGAL · PRIVACY

Privacy policy.

What data DeBabel (the real-time multilingual Discord translation bot, images and GIFs included) processes, why, for how long, and what rights you have over it. It applies to anyone who interacts with DeBabel, regardless of which Discord server you use it in.

Last updated: 9 November 2026 Version: 1.6.0 The "Translation context" item (Section 2) and the related additions to Sections 3 and 4 apply from 16 November 2026, 10:00 UTC. Contact: privacy@debabel.org

DeBabel is a project operated by an independent developer based in Switzerland. There is no company behind it at this time: references to "we", "us" or "DeBabel" refer to the developer in their personal capacity. The data controller is therefore the developer as a natural person, domiciled in Switzerland. The contact channel is privacy@debabel.org: we answer every request concerning your data and we disclose the controller's full identifying details to anyone entitled to them, including supervisory authorities and anyone who needs to exercise or enforce a right.

Processing is subject to the Swiss Federal Act on Data Protection (FADP) and, for users in the EU/EEA and the UK, to the GDPR to the extent it applies. The representative in the European Union under Art. 27 GDPR is in the process of being designated: their contact details will be shown here as soon as they are available. Until then, and in any case afterwards too, you can write directly to privacy@debabel.org on any matter relating to the processing of your data.

Who decides what. DeBabel is activated in a Discord server by an administrator of that server, who chooses whether to install it, in which channels and into which languages. Those choices determine which messages are translated and who can see them: in respect of them the administrator acts as data controller for their own server, and the Terms of Service require them to inform members and to make sure they have a legal basis for doing so (this page can be linked for that purpose). We are the controller for the technical operation of the service: translation, message mirrors, the retention described on this page, security and billing. Where the two spheres overlap we consider ourselves joint controllers under Art. 26 GDPR; in any case you can exercise your rights (Section 7) directly with us, without going through the server administrator. Discord Inc. and the providers listed in Section 5 process data under their own respective policies.

01What DeBabel does, briefly

DeBabel listens to messages posted in Discord channels where it has been installed by a server administrator, translates them into the languages configured for that server, and posts the translations as "mirror" messages in the corresponding channels. The same applies to images and GIFs: DeBabel recognizes the text in them, translates it, and reposts the image with the translated text. It also propagates edits, deletes, reactions and replies between mirrors, so that the original message and its translations stay in sync.

To do this, DeBabel needs to read the content of messages and of the images attached to them, link mirrors back to their original author, and remember each user's language preference for each server.

02What data we process

We process the following categories of data, all tied to your Discord user ID and the specific server (guild) where the activity happens:

We do not process: your credit card or payment instrument data (handled exclusively by the processor, see Section 5), voice content, attachments other than text, images and GIFs (for example documents, archives, audio or video files, which are ignored), your IP address beyond what Discord and our infrastructure providers see at the network layer, or any data outside the Discord servers where you have chosen to interact with the bot.

A note on images. Because DeBabel reads the text contained in images in order to translate it, any personal information visible in a screenshot you post (names, addresses, contact details, other people's conversations) is recognized and sent to the translation providers just like any other text. By posting content in a translated channel you represent that you have the right to share it, even where it contains information about other people: responsibility for that choice lies with the person posting. Weigh what you post in translated channels the same way you would weigh it for a text message.

Special categories of data. DeBabel is not designed to process special categories of personal data (Art. 9 GDPR: health, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data), and the Terms of Service prohibit posting them in translated channels. If they do appear in a message or an image, they are processed only for the time technically needed to translate, follow the deletion rules in Section 4, and are neither used for any other purpose nor extracted in structured form. An administrator can switch image translation off entirely for their server with /debabel-server config image-translation action:disable, or leave the channels where such content circulates out of translation.

03Why we process it (legal basis)

For users in the EU, UK and other jurisdictions that require a legal basis under data protection law, the basis is one of the following:

We do not use your messages, images or any other data to train artificial-intelligence models, ours or third parties', in line with Discord's Developer Policy; the providers listed in Section 5 are bound by the same prohibition. We make no automated decisions with legal or similarly significant effects on you and we do not profile you. If you don't want DeBabel to process your messages, the most direct option is to not post in channels where DeBabel is active. Server administrators can also configure which channels DeBabel mirrors.

04How long we keep your data

We keep each category of data only for as long as necessary for the purpose it was collected for, and we apply automatic cleanup routines to enforce these limits.

These windows describe the maximum retention absent a deletion request, and reflect what we currently consider proportionate; we may adjust them (more likely shortening than lengthening them) and any change will be reflected on this page. Your individual rights remain unaffected in any case: you can request deletion of your data at any time with /debabel privacy delete-my-data, regardless of what the server administrator has decided (see Section 7).

05Where your data goes (providers and international transfers)

To provide the service, DeBabel relies on providers that process data on our behalf (sub-processors) and on two parties that process it as independent controllers: Discord and the payment processor. The list of providers at the bottom of this page, which forms part of this policy, states for each of them its registered seat, where it may process the data, what it receives, for what purpose, how long it keeps it and the safeguard the transfer relies on. We only use providers that appear in the list.

Server. DeBabel and its database are hosted in data centres in the European Union / European Economic Area (EU/EEA), by the hosting providers named in the list, which also states where each of them may process the data: the EU/EEA or, for those processing outside it, the country. We do not use data centres outside the EU/EEA for the server. Network traffic passes through Cloudflare, Inc. (United States), which also manages the DNS for debabel.org and stores the encrypted database backups and, in data centres in the European Union, the image copies described in Section 2.

Message translation. The text of messages is sent to language-model providers that translate it.

Images. Images posted in translated channels are sent to providers of text-recognition and visual-analysis models. These read the text in the image and analyse the elements needed to translate it well: for example, among the words written in the image they recognise brands, product names and proper names that must stay unchanged, the style and colours of the text, and the type of image. The analysis concerns the text of the image and its appearance: it is not meant to recognise the people, places or objects shown and is not used for that. The text that has been read is then translated like the text of messages. To verify the quality of translated images, the rendered image and its source may also be sent to language-model providers. Until 9 October 2026, 10:00 UTC images are read and analysed only by EU-based providers named in the list; from that date they may also be read and analysed by the US-based providers named in the list. Image translation is enabled by default; a server administrator can disable image translation for the entire server with the command /debabel-server config image-translation action:disable: images posted after it is disabled are not sent to these providers. This is a choice made by the server and does not replace your right to object to the processing of your data, described in Section 7.

How we choose the provider. For each request we choose a provider from the list based on cost, availability and response time, and we may switch from one to another at any time. The conditions are the same for all of them: they receive the content only to process the request, they do not use it to train their own models and they do not keep it beyond the request, except where the list states a different period, which does not exceed 30 days and serves only security, abuse prevention or the resolution of technical problems.

Where data is processed. By default, and regardless of where the author is located, messages and images may be processed by providers based in the EU or in the United States. At the administrator's request and under a separate agreement, a server can be configured with the EU residency profile: in that case the messages and images of that server are processed only by providers with their seat and processing infrastructure in the EU/EEA, named in the list, with no passage outside the EU/EEA, not even on failure.

Payments. Credit purchases are handled by Polar Software Inc. (United States) as merchant of record: Polar is the contractual counterparty to your purchase, collects the payment, calculates and remits applicable taxes, issues the invoice, and handles refunds and disputes. Polar collects and processes payment and billing data as an independent controller, under its own policy (polar.sh/legal/privacy); card processing is carried out through its collection providers. We do not see or store card data: we receive from Polar only the order data described in Section 2. Transfers to Polar from the EU/EEA, the UK and Switzerland take place on the basis of the Standard Contractual Clauses adopted by the European Commission.

Discord. Discord itself is the platform on which the bot operates and is, of course, the source and destination of all messages DeBabel reads and writes.

International transfers. Transfers to providers that have their seat and process the data in the EU/EEA require no additional safeguards. Where data is transferred from the EU/EEA, the United Kingdom or Switzerland to the United States, the transfer relies, for each recipient as stated in the list: on certification to the Data Privacy Framework (the EU-U.S. DPF with the UK Extension, and the Swiss-U.S. DPF, recognised as adequate by the European Commission and by the Swiss Federal Council); or on the Standard Contractual Clauses adopted by the European Commission, with the adaptations recognised by the FDPIC for Switzerland and the UK Addendum. You can ask for a copy of the safeguards at privacy@debabel.org.

Changes to the list. We update the list with the date of every change and keep its history. Adding a provider of the same category under the same conditions, or removing one, takes effect when it is published in the list. Moving the server from one EU/EEA country to another, with a provider already in the list, does not require a change to the list. A provider in a country other than those stated in this section, the server outside the EU/EEA, or less favourable conditions are material changes and are communicated in advance, as described in Section 10.

If you use DeBabel for an organisation. Where you are the controller of your members' data and you need a data processing agreement under Art. 28 GDPR, we make one available on request: write to privacy@debabel.org.

06Who can see your data

Within DeBabel:

We do not sell, rent, or share your data with any party for advertising, profiling, or any commercial purpose unrelated to running the bot. DeBabel does not contain advertising.

If we are ever legally required to disclose data (for example in response to a valid legal request from a competent authority) we will do so only to the extent strictly necessary and, where the law permits, we will inform you.

07Your rights and how to exercise them

Regardless of where you live, DeBabel offers the same set of practical rights to all users. Depending on your jurisdiction (EU/EEA, UK, Switzerland, California, Brazil, China, Japan, South Korea, Singapore, South Africa, the UAE, Saudi Arabia, Australia and others), you may have additional statutory rights: the rights listed below are designed to satisfy the common core of these laws.

You can:

We will respond to written requests within the timelines required by applicable law (typically 30 days under the GDPR, 45 days under the CCPA).

A limit that is not up to us: accounting records of real-money purchases cannot be deleted on request for as long as the statutory retention obligation lasts (10 years). In that case we apply the minimization described in Section 4, stripping the record of data that is not necessary, but we cannot delete the record itself.

Aggregated and anonymous data. We may produce and use aggregated or anonymized statistics (for example: number of translations per language, average processing times) that cannot identify you; such data is not personal data and is not subject to this policy.

08Children

DeBabel is not directed at children. Discord's own Terms of Service require users to be at least 13 years old (or older in some jurisdictions). If you believe a child under the applicable age has provided data to DeBabel, write to privacy@debabel.org and we will remove it.

Purchases. Credit purchases are accessible to any member of the server. Refund requests or disputes over an unauthorized payment (including a purchase made by a minor using an adult's payment instrument) should be directed to Polar, which is the seller and contractual counterparty to the purchase (see Section 5): it is Polar that collects the payment and handles refunds and chargebacks. In these cases the order data we receive belongs to the payment holder, not to the minor; the payment holder can exercise their own rights over it like any other data subject (Section 7). What remains data about the minor is what is tied to their use of the bot on Discord (language preference, message mirrors, feedback) for which the above applies.

We cooperate either way. If whoever holds parental responsibility, or the payment holder, reports the situation to us, we delete all data referring to the minor without argument and minimize the data tied to the order to the strict indispensable: we do not ask for proof or raise formal obstacles. The only limit is the statutory one already noted in Section 4: the accounting record of a real-money purchase must be kept for the period required by tax law, but we strip it of identifying data that is not necessary. For any request of this kind: privacy@debabel.org.

09Security

The database is kept on servers in data centres in the EU/EEA (Section 5 and the list of providers). The measures in place include: encryption of traffic in transit (TLS), system and database access restricted to the developer alone through encrypted and authenticated management channels, data minimization (this policy describes everything we retain), automated pseudonymization and deletion under the windows in Section 4, and regular system security updates. Database backups are encrypted before leaving the server and stored on Cloudflare R2 storage (see Section 5 for Cloudflare); deletions propagate to backups through their rotation, normally within 7 days and at most within 35. Image copies kept for quality checks are not part of the backups; they are stored on Cloudflare R2 storage in the European Union, and removal on request deletes them there too. We do not hold formal certifications (ISO 27001, SOC 2, etc.), as is normal for a project of this size; we will update this page if and when that changes.

In the event of a personal data breach we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Art. 33 GDPR. We inform affected individuals directly where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR), and in any case whenever applicable law requires it. We also notify Discord of any unauthorized access to data obtained through its APIs, as required by Discord's Developer Terms.

10Changes to this policy

We may update this policy as DeBabel evolves, for example if we add new features, change sub-processors, or formalize the legal entity behind the project. The "Last updated" date at the top of this page reflects the date of the most recent change. We consider material any change that introduces a new purpose, a new category of data, a longer retention period, a recipient outside the categories already listed in Section 5, a transfer to a country without the safeguards described here, or a reduction of your rights. Material changes will be communicated through the bot (welcome direct message and /debabel privacy info) before they take effect. Other changes (for example replacing a provider with an equivalent one, shortening a retention period, clarifications or corrections) take effect upon publication on this page and the update of the date at the top.

11Contact

For any privacy-related question or request, write to privacy@debabel.org. We reply within the timelines set out in Section 7.

For general questions about the bot, see debabel.org or the configuration commands inside Discord.

AAnnex: list of providers

This list forms part of the privacy policy (Section 5). We only use the providers listed here: a provider that does not appear in the list receives no data. For servers with the EU residency profile we only use the entries marked "EU profile". Last updated: 25 October 2026.

Providers that process data on our behalf

Independent controllers (they process data on their own account, under their own policy)

History of changes

This policy is published in Italian and English. The English version is authoritative. Where translations into other languages are available, in case of discrepancy the English text prevails.